FDA 21 CFR Part 11 Electronic Records Compliance

Evaluate compliance with FDA 21 CFR Part 11 requirements for electronic records and electronic signatures in FDA-regulated industries

BiotechHealthcare20 minutes20 questions

1. System Validation

Are all computer systems creating/maintaining electronic records validated per risk-based approach?*

§11.10(a): Validation ensures accuracy, reliability, and performance

Is system validation documented with protocols, test scripts, and validation reports?*

Installation Qualification (IQ), Operational Qualification (OQ), Performance Qualification (PQ)

Are systems periodically reviewed and revalidated when changes occur?*

§11.10(a): Change control and revalidation for system modifications

2. Audit Trails

Do systems generate secure, computer-generated audit trails for all record creation, modification, and deletion?*

§11.10(e): Independent audit trail for operator entries and actions

Do audit trails capture user ID, date/time stamp, and the action taken?*

Who, what, when, and why documentation for all changes

Are audit trails reviewed regularly and available for FDA inspection?*

§11.10(e): Audit trails must be retained and reviewable

Can you generate human-readable copies of electronic records including metadata?*

§11.10(b): Records must be readily retrievable in human-readable form

3. Electronic Signatures

Are electronic signatures linked to their respective electronic records?*

§11.70: E-signatures must be linked to records they sign

Do electronic signatures include the printed name, date/time, and meaning of signature?*

§11.50(a): Signed records must contain required information

Are electronic signatures unique to one individual and not reused or reassigned?*

§11.100(b): No two individuals may have same electronic signature

Do users sign with at least two distinct identification components (e.g., ID + password)?*

§11.200(a): Multi-factor authentication for electronic signatures

4. Access Controls & Security

Do you enforce unique user IDs and strong passwords/PINs?*

§11.300: Authority checks ensure only authorized individuals access systems

Are access privileges based on job function with documented authorization?*

Role-based access control (RBAC) limiting access to authorized functions

Do you use operational system checks to enforce permitted sequencing of steps?*

§11.10(g): System prevents actions out of required sequence

5. Data Integrity (ALCOA+)

Are electronic records attributable, legible, contemporaneous, original, and accurate (ALCOA)?*

ALCOA+ principles: also complete, consistent, enduring, available

Do you prevent unauthorized deletion or alteration of electronic records?*

§11.10(c): Protection of records to enable accurate retrieval

Are backup and disaster recovery procedures in place with tested restore capability?*

§11.10(b): Protect records from loss through backup systems

6. System Controls & Documentation

Are procedures and controls documented in written policies (SOPs)?*

§11.10(k)(1): Written policies covering Part 11 requirements

Are personnel trained on Part 11 requirements and system procedures?*

§11.10(i): Training on electronic record/signature systems

Do you maintain documentation to be made available for FDA inspection?*

§11.1(c): Systems and documentation subject to FDA inspection

Please answer all required questions to see your results